Networks

Ask something
Discussion Locked

Cisco logging facilities

0 helpful
5 replies

by techstop

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have a Cisco AS5200 running IOS 12 set up to log using TACACS+ (e.g., when a user wants to access the Internet, they are challenged for username and password).

The log files used to resolve, it seemed to me, but no longer do; now they just output IP addresses.

The company wants to know what sites these people are visiting, but the IP addresses are "less than useful."

I cannot recall how to make these resolve. Ideas?

Thanks.

5 replies

by meganetcomputers

It could possible be that you do not have DNS specified on the device and it is not able to resolve the IP address so it just gives you raw data.

by techstop

DNS is specified. Not only that, the configuration wasn't changed, but the resolution of the addresses STOPPED occurring. It was occurring before, and now it has stopped. I suspect something has changed on the Linux box (where the logs are collected by syslogd) to cause this, but I'm not sure.

by jon shorten

If this used to work and now doesn't, have you (or your ISP) changes the DNS server address(es) for your network.

I'd check the DNS server address from a windows PC which can resolve names, (use ipconfig /all), then compare this to the "ip name-server a.b.c.d" entry in the Cisco config.

If you're sure that this entry is correct, check that DNS resolution is enabled ("ip domain-lookup")

If all this chacks out, I'd suspect a problem with the reverse zone file on your DNS server.

hope this helps.

JonS

by techstop

There is no "ip domain-lookup" command possible in the configuration. The only command possible that starts with "ip" is for setting the interface address. Remember, this isn't a regular Cisco IOS; it's a PIX.

by techstop

This question is still open. Jon's proposed solution, while much appreciated, had already been considered, but could not be done, because the command in question, while a normal Cisco command, is not available on this firewall. (The firewall is being upgraded, and if this command is available on the new version, I will close the question and award Jon the points.) Still looking for suggestions.

This discussion is closed to new replies.